Privacy Policy

Account & Profile Information

• Name (first, last, middle, prefix, suffix), email address, username, and profile photo (via Google OAuth sign-in or email registration)
• Contact details you provide: phone number, location, LinkedIn URL, GitHub URL, portfolio URL
• Work experience, education history, skills, personal projects, and certifications
• Resume and cover letter content you upload or that we generate for you
• Job preferences (such as the lowest pay you want, with its currency and period), target roles, and location preferences
• Where you can work: the countries where you may work, the countries where you would need a visa, and the languages you speak, with your level. Each answer is optional, and a blank answer never hides a job from you. To look for jobs at all, Aladdin needs one country: from these answers, from your location, or from the places where you want to work. Aladdin uses your work-permit answers to show you jobs that you can take and to answer this question on applications. For applications, the AI models of the Aladdin desktop app can get them (see Section 8). When you analyze a job with the Chrome extension, your work-permit answers do not go to the AI model that scores it (see Section 3). When Aladdin finds jobs for you, your work-permit answers never go to an AI provider (see Section 5).
• Work authorization & EEO (optional, self-declared): citizenship or work-authorization status, and voluntary EEO fields (gender, ethnicity, veteran status, disability status). You can decline to provide any of these. The Aladdin desktop app uses your work-authorization answers to answer those questions on job applications. If you choose to provide voluntary self-identification answers (such as gender, race or ethnicity, veteran status or disability) and turn on 'Let Aladdin answer self-identification questions with my answers', we use them only to answer the matching voluntary questions on applications the desktop app submits for you. Our AI service providers process them while your application is being filled. We never use these answers for anything else, and you can change them, clear them or turn the setting off at any time. That setting is not available yet; until it is, the desktop app never answers these questions with your answers: it picks the form's own "prefer not to answer" option, or leaves an optional question empty. It never guesses these answers, except when a required question offers no such option: then the AI agent chooses an answer itself.

Job Data

• Job postings you analyze or interact with through the Service
• Job match scores, skill gap analyses, and application status
• Your answers on earlier application forms: the question and what you answered on Aladdin's question card, or approved before an application was sent, with the job and the date, so Aladdin does not ask you again. While Aladdin fills a later application, our AI service providers (Section 8) receive your newest kept answers at the start, and more when the AI model looks one up. You can see and remove each one on the "Questions employers ask" page.
• Employer information extracted from job listings
• Jobs that Aladdin finds for you in its pool of public job posts, with the match % and its parts (skills, level, place and pay), the skills you match or miss, and the short "why this fits" lines

Generated Documents

• Tailored resumes and cover letters generated by our AI
• Document quality scores and improvement suggestions

Usage & Analytics Data

• Pages visited, features used, and actions taken within the Service
• Device type, browser type, operating system, and screen resolution
• IP address, approximate geographic location (country/region level)
• Referral source and session duration

Payment & Subscription Information

• Billing details are processed by Stripe. We do not store your full credit card number, CVC, or bank account details on our servers. We receive only a tokenized reference (Stripe customer ID), card brand, last four digits, and expiration date from Stripe.
• Subscription tier (free, pro, max, etc.), monthly document-generation quota, credit usage counters, bonus credit balance, and the timestamp of your last credit reset are stored on our servers to enforce plan limits.

Networking & Outreach Data

• When you use the Contact Suggestions feature, we fetch and cache third-party professional contact records (full name, job title, LinkedIn URL, work email, seniority, department, tenure, location, photo URL) keyed by company domain. See Section 4 for details.
• AI-generated LinkedIn DM and email drafts, your outreach pipeline status per contact (not contacted, reached out, replied, interview, closed), and any notes you add.

Site Credentials (Automated Applications Only)

• Job-site usernames and passwords that Aladdin saves for you are stored on our servers, encrypted. When Aladdin creates an account or signs in to a job site for you in the desktop app, the AI model working on the application receives your email address and the password Aladdin made for that site, and the sign-in codes sent to your email, so it can type them into the site's own form. In a cloud application, the AI model sees only placeholders for the password and the code, and Aladdin types the real ones into the site's form itself. Aladdin removes the passwords and sign-in codes it handles from the records it keeps of a run. If a job site shows a password as plain text on a page, it can appear in a screenshot or a page copy. The Aladdin Chrome extension does not collect site passwords. See Section 6.

Waitlist / Survey Data

• If you join our beta waitlist, we collect your use case description, current company, role, applications per week, and feature interests for admission review.

We use the information we collect to:

• Provide the Service — match you with relevant job postings, generate tailored resumes and cover letters, and track your applications
• Communicate with you — send transactional emails, document-ready notifications, and product updates (you can opt out of non-essential communications)
• Ensure security — detect fraud, prevent abuse, and enforce our Terms of Service
• Analytics — understand usage patterns to improve features, fix bugs, and guide product decisions

We do not sell your personal information to third parties. We do not use your data to train AI or machine-learning models.

The Aladdin Chrome extension works with your Aladdin account. This section explains what it reads, what it sends to us, and when. You control each of these in the extension's Settings → Privacy.

Finding job postings. The extension runs on the web pages you open so it can tell whether a page is a job posting. By default it checks only well-known job sites and applicant-tracking systems, such as LinkedIn, Indeed, Greenhouse, Lever and Workday; you can extend this to all websites. This check happens entirely in your browser, and nothing about the pages you visit is sent to us because of it. If you pause job detection, the extension stops checking pages and the application tracker described below pauses too.

Page analysis.When you click Analyze, on the page or in the extension's side panel, the extension sends us the page's address (URL) and a copy of the page's HTML, including the content of frames embedded in the page. Our servers extract the job details from it and score the job against your profile. To extract the job details, they send text from the page through OpenRouter to Anthropic's Claude models; to score the job, they can send the extracted job details and your profile, without your work-permit answers, to OpenAI's GPT-6 Luna directly (see OpenAI in Section 8), so that the job gets the same kind of match % as the jobs that Aladdin finds for you (see Section 5). We keep the extracted job details (such as title, company, description and the page address) in your account. We do not keep the copy of the page. Because the copy is of the whole page, it can include other information shown on that page, such as your name in the site's header or answers you have typed into a form on that page. On every page upload, from Analyze or the application tracker, the extension first removes the values of password and hidden fields and the security tokens it recognizes in form fields, meta tags and link addresses; the page's own scripts are kept as they are. It also leaves out frames it recognizes from sign-in, payment, chat and captcha providers. On LinkedIn, the extension removes the messaging panel from the copy before sending it. Page analysis is on by default. If you turn off "Allow page analysis", the extension sends no page copies and Analyze is unavailable; your choice is saved in the extension and in your Aladdin account.

Application tracker (optional, off until you turn it on). The tracker notices job applications you submit yourself so you can keep a record of them. When you turn it on in Settings → Privacy, the extension first explains what the tracker does and asks you to confirm, then asks Chrome for the additional access it needs to observe network activity. While it is on, it watches page loads and the network requests pages make in your tabs (their addresses and, on a page where you are filling in an application, the name of the operation the site sends), and it notices clicks on apply buttons, typing in forms (not what you type) and confirmation pages. It does this on every website, even if job detection is set to well-known job sites only. This monitoring happens in your browser and is not sent to us. It starts only when you act: when you click an Apply button, start typing in an application form, click Next, Continue or Review in it, or open an application page yourself. A form that is already on the page, a click made by a script, or the word "apply" in the search part of an address starts nothing. This includes application forms embedded in the page from Greenhouse or iCIMS: only while the tracker and job detection are on and you are signed in, and never in incognito tabs, the extension adds a small script to those forms that notices the same actions and reads no field values. When you start applying, the extension checks the page inside your browser. If the page is a real job posting and page analysis is on, it sends us the page's address and a copy of its HTML, cleaned as described under Page analysis, so we can identify the job. It normally does this once per application. A page counts as a job posting only if it is a posting page on a list of well-known job sites, carries standard job-posting data at an address that looks like a job page, has Greenhouse's application form for that same job embedded in it at such an address, or is a LinkedIn job that the extension verifies. Recruiter, admin, sign-in and bot-check pages never count. For any other page, such as a loan or credit-card application or a web search, the extension sends nothing and shows you nothing. When it looks like you submitted the application, it asks you "Did you apply?" Nothing is saved to your account before you answer: our servers only identify the job from the page, the application is saved to your tracker only if you say yes, and "No", or no answer, saves nothing. If page analysis is off, the tracker sends no copy of the page; if you still answer "Yes", it saves the job's name and link to your tracker. The tracker never runs in incognito tabs, and turning the tracker or job detection off stops any page check or upload in progress, including uploads that have not been sent yet. You can turn the tracker off at any time.

On your device, the tracker keeps the recent job postings it has identified (title, company and page address; up to 200, each for up to 7 days), the applications it is following, which have no fixed limit, and the last job you analyzed in each tab (title, company, page address and match score; at most 50). The last analyzed job is kept for about 4 hours (deleted the next time the tracker runs after that). An application stays on that list while it is in progress, however long that takes. It ends when, for example, you submit it, close its tab or turn the tracker off. It is deleted about 7 days after it ends; if a "Did you apply?" question about it goes unanswered, it can stay for up to about two weeks. For a page that is not a job posting, it keeps only a record without the page's address, which it deletes within 45 minutes, or when Chrome next starts. It keeps nothing about incognito tabs. Short notes that stop the tracker from asking you twice are kept for up to 7 days, and a note of each application saved to your tracker (the job's ID and the time) for up to 30 days. Signing out of the extension deletes all of this.

Documents and networking. When you ask for a tailored resume or cover letter, the extension asks our servers to create it for the job you analyzed. You can then preview it, download it, or drag it into an upload field on a page. Where we have or can find contacts for the hiring company (see Section 4), the Network tab shows people to contact there and draft messages from our servers; if you change a contact's outreach status or add a note, we save it to your account. The extension never sends a message or email for you: you copy a draft and send it yourself. Contact photos load directly from the website that hosts them.

Importing your LinkedIn profile. If you choose "Import from LinkedIn" in the Aladdin web app, the extension opens your own LinkedIn profile in a browser tab and scrolls through it so every section loads. LinkedIn loads the lower sections only when the page is scrolled, so the extension uses Chrome's debugging interface to send scroll input to that tab; while it does, Chrome shows a notice that the extension is debugging the browser, which ends when scrolling ends. The extension then reads your name, headline, location, about section, experience, education, skills, certifications, projects and the profile's visible text, and hands this to the Aladdin web app, which sends it to our servers to fill in your profile. The extension reads your LinkedIn profile only when you start an import. When the Aladdin web app's Connected Accounts page asks, it may also check an already-open LinkedIn tab to see whether you are signed in to LinkedIn.

Signing in. The extension signs in through the Aladdin web app. It stores your Aladdin sign-in tokens, encrypted, in Chrome's storage for the extension, and reads one Aladdin cookie (csrf_token, on app.aladdin-ai.net) so it can restore your session after Chrome restarts. It does not read other websites' cookies and does not ask for or store passwords for other websites.

Usage diagnostics. Unless you turn off "Share usage diagnostics" in Settings → Privacy, the extension sends usage and error information to Aladdin's servers, linked to your account ID: for example, whether an analysis succeeded, how long it took, and the name of the website involved (such as boards.greenhouse.io). It never includes page content or anything you type. Our staff look at the diagnostics of a specific account only to investigate a problem you report, to keep the Service secure, or when the law requires it. The extension does not send data to Datadog or to any other analytics service.

What the extension does not do. It does not send us a history of the websites you visit, does not access your email, does not fill in or submit job applications, and does not sell your data. Apart from checking pages for job postings, the only monitoring of your browsing is the optional application tracker described above, and only while you have it turned on.

When you generate application documents for a job, the Service may suggest relevant professional contacts at the target company to help you network. All the contact data Aladdin shows comes from Apollo.io, a licensed business-contact data provider: we reuse contacts we have already saved from it and, when we need more, look people up with it. We cache this data on our servers to improve performance. To find people at a company, we send Apollo.io the company's name or web domain and search filters (job titles, seniority and department) that we derive from the job posting. We never send it your name, email address or profile. For each person it finds, Apollo.io returns their name, job title, seniority, department, location, time in their current role, LinkedIn profile link, photo link and work email, and, for Genie Max subscribers, a personal email address where one is available. Apollo.io does not find people at every company.

We also store your outreach tracking status (e.g., whether you have contacted someone, received a reply, or scheduled an interview) and any AI-generated outreach drafts associated with your account. If a contact replies to you and you paste their reply into Aladdin, we store it (up to 800 characters) with your outreach tracking. When you ask for a follow-up, we send that reply to OpenAI's GPT-6 Luna, through OpenRouter, to draft one, and store the drafts too. Aladdin does not read your inbox for replies. We do not sell, rent, or share third-party contact data. We do not contact anyone on your behalf without your explicit action, such as turning on emailing contacts (see the Gmail disclosure in Section 8).

If you replied to an Aladdin user, they may have pasted your reply into Aladdin to track the conversation and draft a follow-up; it stays in their account until they delete their account. If you are a third party whose contact information or reply appears in our system and you would like it removed, email privacy@aladdin-ai.net. Aladdin users can ask us to delete their outreach history at any time by emailing the same address, or delete it with the rest of their data by deleting their account.

The Service uses large language models to read job postings, and to generate personalized resumes, cover letters, outreach drafts, job match scores, and skill gap analyses. Anthropic's Claude models, which we reach mostly through OpenRouter (some reads of job posts go to Anthropic directly), read job postings and score the resumes and cover letters we write. Aladdin's apply agent, which fills in job applications for you in the cloud, uses Anthropic's Claude directly (see Anthropic in Section 8). OpenAI's GPT-6 Luna works out job match scores, analyzes skill gaps, and writes resumes, cover letters and outreach drafts. We send the match-score requests to OpenAI directly, and the others through OpenRouter. TypeSafe's JEV model checks that the resumes and cover letters we write state only facts that your profile supports.

What is sent to the model. For each generation we send the relevant portions of your profile (e.g., work experience, skills, education, projects, contact name used in the letter) along with the job posting content (title, company, description, requirements) and, for outreach drafts, the contact's public professional details (name, title, company). When you analyze a job with the Chrome extension, text from the page you analyzed is sent to the model so it can pull out the job details.

What we store. Generated resumes, cover letters, LinkedIn DM drafts, email outreach drafts, outreach subject lines, and any quality scores or improvement suggestions are stored in your account so you can view, re-download, or edit them. Drafts are visible only to you.

How Google handles this data. Data sent to the Gemini API is processed under Google's Generative AI API terms. Per those terms, Google does not use Gemini API inputs or outputs to train its foundation models.

How OpenRouter handles this data. Requests to Claude models go through OpenRouter, except some reads of job posts and the apply agent's requests, which we send to Anthropic directly (see Anthropic in Section 8). Requests to OpenAI's GPT-6 Luna also go through OpenRouter, except the job match scores, which we send to OpenAI directly (see OpenAI in Section 8). OpenRouter passes each request to a provider that runs the model we select. Every request carries OpenRouter's "deny" data-collection setting, so it goes only to providers that OpenRouter lists as not collecting user data (see OpenRouter in Section 8). We also run our own resume-agent service on our servers, which sends requests through OpenRouter to OpenAI's GPT-6 Luna to write resumes and cover letters, and to Anthropic's Claude Haiku to score them; prompts and outputs pass through that service but are not retained by it outside the generated document record.

Jobs that Aladdin finds for you. Aladdin collects public job posts into one pool and finds the jobs in it that fit your profile. Our Job Data Notice explains what it collects from job posts. Three AI providers help, and each one gets only what its step needs:

• OpenAI's GPT-6 Luna gets your profile and the job, and works out the match % and its parts. We send these requests to OpenAI directly (see OpenAI in Section 8). When you open a job, GPT-6 Luna, which we reach through OpenRouter with the same "deny" setting, writes the short "why this fits" lines from your profile, the job's title, company, place and facts, and the match % and its parts.
• Google Gemini gets a short search text made from your profile: the roles and level you want, your skills and your most recent roles. It also gets the text of job posts. It turns both into numbers, so that we can find the jobs closest to your profile.
• Anthropic's Claude reads each job post once, to find facts such as the place, the pay and the languages that the job asks for. For this step, it gets job posts only, never your data. We send these job posts to Anthropic directly or through OpenRouter.

Here, your profile means the roles and level you want, your skills, work experience, education, projects and certificates, and your job preferences: places, job types, work styles, the lowest pay you want, whether you would move for a job, and your languages.

Your work-permit status and your contact details. Your work-permit status (the countries where you can work, and where you would need a visa) never goes to these providers when they help find jobs for you. It also never goes to GPT-6 Luna when it works out the match % of a job that you add. Our own code uses it to filter the jobs that Aladdin finds. We remove your name, email address, phone number and street address from the text that we send them for this.

Training on your data. We do not use your data, including your resumes, cover letters, outreach drafts and profile, to train AI or machine-learning models. We may use anonymized, aggregated usage statistics (for example, how often a particular skill appears in job postings) to improve the Service.

The Aladdin Chrome extension does not ask for, store, or use passwords for other websites, and it does not fill in or submit job applications.

Aladdin fills in job applications for you in a cloud browser that Browser Use, Inc. runs for us (see Browser Use in Section 8). You start it from the Aladdin web app. Aladdin applies in the cloud only after you turn on Auto-apply and press Start. It then submits each application without asking you first, and goes on to the next job until you stop it or turn Auto-apply off. Job-site usernames and passwords that Aladdin saves for you are stored on our servers, encrypted. When Aladdin creates an account or signs in to a job site for you in the desktop app, the AI model working on the application receives your email address and the password Aladdin made for that site, and the sign-in codes sent to your email, so it can type them into the site's own form. In a cloud application, the AI model sees only placeholders for the password and the code, and Aladdin types the real ones into the site's form itself. Aladdin removes the passwords and sign-in codes it handles from the records it keeps of a run. If a job site shows a password as plain text on a page, it can appear in a screenshot or a page copy. What Aladdin sends while it works on an application is described in Section 8: under Anthropic and ScaleDown for a cloud application (and under Telegram, if you connect it), and under OpenRouter for the desktop app; requests that go through OpenRouter go only to providers that run the model we select and that OpenRouter lists as not collecting user data. Diagnostic records of an application run are deleted after 90 days, or when you delete your account: the run traces and measurement logs on our servers, and the run files stored with us when a run ends. They can include text and screenshots of the employer's pages, what the agent typed into the form, and the exact requests sent to the AI models and their replies, which carry your profile, your answers and the job's details; from the moment you give a self-identification answer, the rest of that run's record keeps only technical details and the questions' wording. If you use the desktop app, its own logs and run files, apart from the run files it sends us, stay on your Mac. In a cloud application, the run's page captures stay in its working memory on our servers and are deleted when the run ends. The desktop app also keeps an answer bank in your account: the question text from employers' application forms, with the answer it used or drafted, until you delete it or your account.

If you connect your Gmail to Aladdin, your Gmail connection is stored on our servers as encrypted tokens. The desktop app uses it to read sign-in codes that job sites email you and to check whether an application went through. A cloud application uses it to find the sign-in code or link that a job site emails you (see ScaleDown in Section 8). The Gmail disclosure in Section 8 describes exactly what we read, keep and send.

On the Genie Max plan, you can also connect your Gmail for sending. This is a second, separate connection, with its own Google permission screen. It lets Aladdin send email from your Gmail, but it cannot read, change or delete your email. Its token is stored on our servers, encrypted. The Gmail disclosure in Section 8 describes what it sends and what we keep.

Aladdin uses Stripe for all payment processing. Stripe is PCI DSS Level 1 compliant and is the data controller for the card number, CVC, and full billing address that you enter into its checkout form.

What we store. On our servers we store a Stripe customer identifier, your subscription tier (free, pro, max, trial, etc.), your monthly credit allocation, credits used this billing period, top-up credit balance, the timestamps of your most recent daily and monthly quota resets, and, on the free plan, when your 30-day free trial started (the first time you generated a document on the free plan). We receive metadata such as card brand, last four digits, and expiry from Stripe for receipts. We do not receive or store your full card number, CVC, or bank account details.

Credit usage history. We track each document generation against your quota to enforce plan limits. The counters reset on a daily and monthly cadence and are retained alongside your account until you delete it.

We integrate with the following third-party services, each governed by their own privacy policies:

• All data is encrypted in transit (TLS 1.2+); generated documents and database backups stored in Amazon S3 are encrypted at rest
• User data is stored in a PostgreSQL database on our server in AWS US-East-2 (Ohio) and backed up to Amazon S3 every night
• Frequently accessed data (e.g., session tokens, quota counters) is cached in Redis on our server
• Authentication uses httpOnly, Secure, SameSite cookies to prevent XSS and CSRF attacks; the Chrome extension uses short-lived access tokens and refresh tokens, stored encrypted in Chrome's storage for the extension
• API keys and secrets are stored in environment variables and secret management services, never in source code
• We conduct regular security audits and employ multiple independent AI code reviewers to catch vulnerabilities before deployment
• Access to production systems is restricted to authorized personnel

We use the following cookies:

Monitoring cookies. The web app's Datadog error and performance monitoring sets a session cookie on the pages where it runs: for signed-in users and, for other visitors, after they answer our cookie banner. Essential cookies cannot be disabled as they are required for the Service to function. We do not use third-party advertising cookies or tracking pixels. The Chrome extension does not set cookies.

Some anonymized, aggregated usage statistics (e.g., how often skills appear in job postings) may be retained indefinitely as they cannot be linked back to you.

You can request deletion of your account at any time via Settings → Data Management → Delete Account, or by emailing privacy@aladdin-ai.net. When you delete your account:

• We begin purging your personal data within 30 days. Most records (profile, work history, applications, job matches, outreach state, drafts, quota rows, waitlist entry, preferences, feedback, notifications, credentials stored in our database such as encrypted Gmail tokens) are hard-deleted via cascading foreign keys.
• Security records of changes to your account are kept to protect it and meet legal obligations. When you delete your account, we remove your personal details and the content of each change from them; what remains shows what kind of change was made, to what kind of record, and when, with internal IDs. We also keep a record that your account was erased, with its random account ID and counts of what was deleted, but no personal details.
• Generated documents are retained for up to 90 days after deletion for backup recovery purposes and then permanently removed from S3.
• Database backups are nightly encrypted copies kept for 35 days, so deleted data can remain in backups for up to 35 days.
• Anonymized, aggregated usage statistics that cannot be re-identified (such as skill frequencies) may be retained indefinitely.
• If you paid us, we keep your payment records, and the details needed for them such as your email address, for up to 7 years as required by US tax and financial regulations, even after you delete your account.
• The cached_contacts table is shared across users and keyed by company — it does not contain your personal data. Your per-user outreach rows that referenced those contacts are deleted.
• To remove everything the Chrome extension keeps on your device (sign-in tokens, settings, and the application tracker's data), uninstall the extension. Signing out of the extension deletes your sign-in tokens and the application tracker's data; your settings stay until you uninstall.
• If you have authorized Gmail access, disconnect the integration in Settings or at myaccount.google.com/permissions to revoke our OAuth grant upstream with Google.

Data export. Before deleting, you can export a full JSON copy of your data via Settings → Data Management → Export Data.

We store your data on servers located in the United States (AWS US-East-2, Ohio). If you access the Service from outside the United States, your data will be transferred to the United States. Our AI providers may process the requests we send them in other countries, such as countries in the European Union.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as our legal mechanism for international data transfers. These clauses provide appropriate safeguards for the protection of your personal data when it is transferred outside the EEA.

Our third-party service providers (Stripe, Datadog, Google Cloud / Gemini, OpenAI, OpenRouter and the model providers it routes our requests to, Apollo.io, Browser Use, Resend, Slack, AWS) maintain their own data processing agreements and transfer mechanisms. TypeSafe hosts its service in the United States. It checks the resumes and cover letters we write. Anthropic gets job posts from us directly and, for each cloud application, the data described under Anthropic in Section 8. ScaleDown gets only the emails described under ScaleDown in Section 8. Telegram receives the questions, your answers and the emails described under Telegram in Section 8, if you connect it. You may request a copy of the applicable Standard Contractual Clauses by contacting us at privacy@aladdin-ai.net.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of access — request a copy of the personal data we hold about you (available via Settings → Data Management → Export Data)
• Right to rectification — request correction of inaccurate or incomplete personal data (edit directly in your profile)
• Right to erasure — request deletion of your personal data (available via Settings → Data Management → Delete Account)
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format (JSON export)
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw consent at any time where processing is based on consent (e.g., turn off the Chrome extension's application tracker)

To exercise any of these rights, use the self-service tools in your account settings or contact us at privacy@aladdin-ai.net. We will respond within 30 days. If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

Legal basis for processing: (a) performance of a contract (providing the Service), (b) legitimate interest (improving our Service, preventing fraud, and ensuring security), and (c) your consent (where explicitly obtained, such as for the application tracker).

Chrome extension: analyzing a page you choose is part of providing the Service (a). Usage diagnostics rely on our legitimate interest in keeping the extension working (b); you can turn them off in the extension's Settings → Privacy. The application tracker relies on your consent (c), which you give when you turn it on and withdraw by turning it off.

Data controller: ALADDIN APPLY AI LLC (Delaware), trading as Aladdin AI, contactable at privacy@aladdin-ai.net.

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you additional rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you (available via Settings → Data Management → Export Data)
• Right to delete — request deletion of your personal information, subject to certain legal exceptions (available via Settings → Data Management → Delete Account)
• Right to correct — request correction of inaccurate personal information (edit directly in your profile)
• Right to opt-out of sale/sharing — we do not sell or share your personal information with third parties for cross-context behavioral advertising
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights

To submit a verifiable consumer request, use the self-service tools in your account settings or email privacy@aladdin-ai.net. We will verify your identity and respond within 45 days.

The Service is not directed at children under the age of 18. You must confirm you are at least 18 to create an account. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal data, we will delete that information promptly. If you believe a child under 18 has provided us with personal data, please contact us at privacy@aladdin-ai.net.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email notification or displaying a prominent notice within the Service. We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: